921553 - Fix some rooting hazards that crept into bindings code

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Two things.

1)  UnionTypes.cpp ends up with code like this:

    nsresult rv = 
      UnwrapObject<prototypes::id::HTMLVideoElement,
                   mozilla::dom::HTMLVideoElement>(
        cx, &value.toObject(), SetAsHTMLVideoElement());

The second arg is a hazard if the third arg gcs.  We should just store that third arg in a stack temporary before we do this code, so we end up with something more like this:

    OwningNonNull<mozilla::dom::HTMLVideoElement>& memberSlot =
      SetAsHTMLVideoElement();
    {
      nsresult rv = 
        UnwrapObject<prototypes::id::HTMLVideoElement,
        mozilla::dom::HTMLVideoElement>(
          cx, &value.toObject(), memberSlot);

2) ConvertJSValueToByteString has an unrooted JSString on the stack that I think is in fact safe, but it's easy enough to shut up the analysis here by rooting it... and safer in the long run.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix some binding rooting hazards that have popped up.

Comment 2

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2c7230203ec2

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2c7230203ec2